paw-mkt-pr
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The research workflows in
references/research-mode.mdprovide templates for shell commands that interpolate user-supplied strings (such as brand names, topics, and domains) directly intoagent-browserCLI calls. This creates an attack surface for command injection if inputs are not validated by the agent's environment. - [COMMAND_EXECUTION]: Setup and discovery routines in
references/shared-patterns.mdcall local shell and batch scripts (e.g.,tool-discovery.sh,chrome-profiles.sh) from a sibling skill directory (paw-mkt-setup), which must be present for full functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests strategic data from local brand-specific files (e.g.,
brand-context.md,strategy.md) located in the.pawbytesdirectory. This ingestion process lacks explicit boundary markers or sanitization, potentially allowing instructions embedded in those files to influence agent behavior. - [DATA_EXFILTRATION]: The skill's patterns for authenticated research on platforms like LinkedIn and X (Twitter) involve saving browser state to local JSON files. These files store session tokens in plaintext, posing a risk of credential exposure if the working directory or generated artifacts are accessed by unauthorized users.
- [EXTERNAL_DOWNLOADS]: The skill's setup instructions involve installing the
agent-browserresearch tool from the official Vercel Labs repository.
Audit Metadata